security.txt
# DOE OSTI Vulnerability Disclosure Policy
## Purpose
This policy outlines guidelines for conducting good-faith security research directed at the Department of Energy (DOE) Office of Scientific and Technical Information (OSTI) web properties and submitting discovered vulnerabilities to DOE.
## Overview
Maintaining the security of our networks and the integrity of scientific data is a high priority at OSTI. Our information systems provide critical services to researchers, scientists, and the public.
Information submitted under this policy is used for defensive purposes to mitigate or remediate vulnerabilities in our networks and applications. OSTI operates its Vulnerability Disclosure Program in alignment with DOE Order 205.1D (Department of Energy Cyber Security Program), OMB Memorandum M-20-32, and CISA Binding Operational Directive 20-01.
---
## Scope
This policy applies to any public-facing website, web application, or digital service owned, operated, or controlled by OSTI that is accessible via a publicly routed IP address or DNS name.
### Out of Scope Systems & Services:
* Industrial Control Systems (ICS) or operational technology.
* National Security Systems (NSS).
* Third-Party Service Providers: Websites or platforms hosted by third-party vendors on behalf of DOE (subject to the vendor's privacy and security policies).
* Non-Public Facing Systems: Internal, non-internet-accessible infrastructure.
---
## How to Submit a Report
Per DOE O 205.1D requirements, security researchers must submit vulnerability reports through the official Department of Energy Vulnerability Disclosure Portal:
Submit a Report: https://doe.responsibledisclosure.com
Reports submitted via this portal are encrypted in transit and at rest, and triaged by the DOE Integrated Joint Cybersecurity Coordination Center (iJC3).
### Report Contents
To assist in validation, please provide:
* Type of vulnerability and affected URL/endpoint.
* Software product, version, and configuration details (if known).
* Step-by-step reproduction instructions or proof-of-concept (PoC).
* Potential impact and proposed remediation/mitigation steps.
* Common Vulnerability Scoring System (CVSS) assessment (if available).
Note: For general questions or backup communications, you may contact OSTI Cybersecurity at security@osti.gov, but formal vulnerability intake occurs via the portal above.
---
## Guidelines & Rules of Engagement
To qualify for protection under this policy, researchers must act in good faith and adhere to the following rules:
1. Do No Harm: Minimize testing to the absolute minimum necessary to prove the presence of a vulnerability. Do not disrupt system operations, modify, or destroy data.
2. Data Protection & Privacy:
* Do not exfiltrate, retain, or transmit any DOE data, including Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), or Official Use Only (OUO) data.
* Avoid accessing communications or stored data beyond what is strictly necessary to demonstrate the vulnerability.
3. Prohibited Activities:
* Denial of Service (DoS/DDoS) testing.
* Physical security testing or social engineering (e.g., phishing, spear-phishing) of DOE/OSTI personnel or contractors.
* Testing on Industrial Control Systems (ICS).
* Requesting monetary compensation (bounties) or property rights for reported vulnerabilities.
4. Confidentiality: Do not publicly disclose any details of a vulnerability or system data without explicit, prior written authorization from DOE/OSTI.
---
## What You Can Expect
* Acknowledgment: DOE/OSTI will acknowledge receipt of triaged submitted reports within 3 business days.
* Triage: Initial assessment and validation will occur within 7 business days.
* Remediation & Communication: Verified vulnerabilities will be assigned for remediation in accordance with federal and CISA timelines. We will keep the reporter updated on progress where feasible.
* Anonymity & Recognition: Reporters may submit anonymously. If public recognition is desired, OSTI will seek to recognize contributions, subject to written authorization and public disclosure approval.
---
## Legal & Authorization
If you conduct security research and submit reports in good-faith compliance with this policy and DOE O 205.1D:
1. DOE will consider your research activities authorized.
2. DOE will not initiate or recommend legal action or law enforcement complaints for good-faith testing under this policy.
3. In the event civil or criminal action is brought by a third party, DOE will take steps to confirm that your activities were conducted pursuant to and in compliance with this policy.
---
## Contact
* Primary Intake Portal: https://doe.responsibledisclosure.com
* OSTI Security Contact: security@osti.gov
* Policy: https://www.energy.gov/cio/articles/vulnerability-disclosure-policy
* Preferred-Languages: en
* Expires: 2029-08-31T00:00:00.000Z
